@wrongstack/cli 0.299.0 → 0.300.0

package/dist/{chunk-4HH3YGG4.js → chunk-MRLYDHQ7.js}

@@ -2,7 +2,7 @@ import {
   fallbackCodexProviderModels,
   filterCurrentCodexModelIds,
   isCodexCatalogModel
-} from "./chunk-GO3TJICK.js";
+} from "./chunk-PYTFS4MC.js";
 
 // src/acp-registry-cache.ts
 import {
@@ -92,6 +92,7 @@ import { ConfigError } from "@wrongstack/core/types";
 import { ProviderRegistry } from "@wrongstack/core/registry";
 import {
   buildProviderFactoriesFromRegistry,
+  createAiGatewayProviderFactory,
   installCatalogModelOutputLimits,
   makeProviderFromConfig,
   withCatalogCapabilities
@@ -157,6 +158,7 @@ async function setupProvider(params) {
     });
   }
   const providerRegistry = new ProviderRegistry();
+  providerRegistry.register(createAiGatewayProviderFactory());
   if (config.features.modelsRegistry) {
     try {
       const factories = await buildProviderFactoriesFromRegistry({
@@ -181,11 +183,12 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
   };
   let provider;
   try {
+    const factoryType = providerConfig.type ?? config.provider;
     const cfgWithType = { ...providerConfig, type: config.provider };
-    if (config.features.modelsRegistry && providerRegistry.has(config.provider)) {
-      provider = providerRegistry.create(cfgWithType);
+    if (providerRegistry.has(factoryType)) {
+      provider = providerRegistry.create(cfgWithType, factoryType);
     } else {
-      provider = makeProviderFromConfig(config.provider, cfgWithType);
+      provider = makeProviderFromConfig(config.provider, { ...cfgWithType, type: factoryType });
     }
   } catch (err) {
     throw new ConfigError({
@@ -213,4 +216,4 @@ export {
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-4HH3YGG4.js.map
+//# sourceMappingURL=chunk-MRLYDHQ7.js.map

package/dist/{chunk-66T43Q4Y.js → chunk-N7ULWBO5.js}

@@ -1,5 +1,6 @@
 
 // src/provider-helpers.ts
+import { catalogProviderIdFor } from "@wrongstack/providers";
 function uniqueModelIds(primary, fallback) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -65,8 +66,8 @@ async function buildPickableProviders(modelsRegistry, config) {
   for (const [id, cfg] of Object.entries(overlay)) {
     if (!isSelectable(id)) continue;
     seen.add(id);
-    const catalogType = cfg.type && cfg.type !== id ? cfg.type : id;
-    const inherited = catalogById.get(catalogType);
+    const catalogType = catalogProviderIdFor(id, cfg.type);
+    const inherited = catalogById.get(catalogType) ?? catalogById.get(cfg.type ?? id);
     const family = cfg.family ?? inherited?.family ?? "unsupported";
     if (family === "unsupported") continue;
     const models = visibleModelIds(id, config, (inherited?.models ?? []).map((m) => m.id), cfg);
@@ -87,4 +88,4 @@ export {
   hasApiKey,
   buildPickableProviders
 };
-//# sourceMappingURL=chunk-66T43Q4Y.js.map
+//# sourceMappingURL=chunk-N7ULWBO5.js.map

package/dist/{chunk-ZNZJ34RF.js → chunk-PEMN4T5O.js}

@@ -2,7 +2,7 @@ import {
   hasApiKey,
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-66T43Q4Y.js";
+} from "./chunk-N7ULWBO5.js";
 import {
   appendHistory,
   backupCurrent
@@ -1020,4 +1020,4 @@ export {
   runLiveProviderPicker,
   runPicker
 };
-//# sourceMappingURL=chunk-ZNZJ34RF.js.map
+//# sourceMappingURL=chunk-PEMN4T5O.js.map

package/dist/chunk-PYTFS4MC.js

@@ -0,0 +1,238 @@
+import {
+  mutateConfigProviders,
+  normalizeKeys,
+  nowIso,
+  writeKeysBack
+} from "./chunk-PJHET45A.js";
+
+// src/auth-menu/openai-codex-oauth.ts
+import { color } from "@wrongstack/core/utils";
+import {
+  buildCodexAuthorizeUrl,
+  CODEX_BASE_URL,
+  CODEX_FALLBACK_REDIRECT_PORT,
+  CODEX_PROVIDER_ID,
+  CODEX_REDIRECT_HOST,
+  CODEX_REDIRECT_PATH,
+  CODEX_REDIRECT_PORT,
+  CODEX_SCOPE,
+  codexRedirectUri,
+  createState,
+  exchangeCodexAuthorizationCode,
+  extractAccountId,
+  generatePkce,
+  parseAuthorizationInput,
+  refreshCodexTokens,
+  resolveCodexModels
+} from "@wrongstack/providers/oauth";
+
+// src/auth-menu/loopback-server.ts
+import { spawn } from "node:child_process";
+import {
+  startLoopbackServer as startSharedLoopbackServer
+} from "@wrongstack/providers/oauth";
+import { callbackHtml } from "@wrongstack/providers/oauth";
+function openBrowser(url) {
+  try {
+    const platform = process.platform;
+    const { command, args } = platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
+    const child = spawn(command, args, { stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function startLoopbackServer(expectedState, ports, signal, callbackPath = "/auth/callback", redirectHost = "127.0.0.1") {
+  const [primary = 1455, ...fallbackPorts] = ports;
+  return startSharedLoopbackServer({
+    port: primary,
+    fallbackPorts: [...fallbackPorts],
+    host: redirectHost,
+    path: callbackPath,
+    expectedState,
+    ...signal ? { signal } : {}
+  });
+}
+
+// src/auth-menu/openai-codex-oauth.ts
+import {
+  CODEX_BASE_URL as CODEX_BASE_URL2,
+  CODEX_CATALOG_FAMILIES,
+  CODEX_PROVIDER_ID as CODEX_PROVIDER_ID2,
+  extractAccountId as extractAccountId2,
+  FALLBACK_CODEX_MODELS,
+  fallbackCodexModelIds,
+  fallbackCodexProviderModels,
+  fetchCodexModels,
+  filterCurrentCodexModelIds,
+  generatePkce as generatePkce2,
+  isCodexCatalogModel,
+  parseAuthorizationInput as parseAuthorizationInput2,
+  resolveCodexModels as resolveCodexModels2
+} from "@wrongstack/providers/oauth";
+var buildAuthorizeUrl = buildCodexAuthorizeUrl;
+var exchangeAuthorizationCode = exchangeCodexAuthorizationCode;
+function startLoopbackServer2(expectedState, signal) {
+  return startLoopbackServer(
+    expectedState,
+    [CODEX_REDIRECT_PORT, CODEX_FALLBACK_REDIRECT_PORT],
+    signal,
+    CODEX_REDIRECT_PATH,
+    CODEX_REDIRECT_HOST
+  );
+}
+var redirectUri = codexRedirectUri;
+async function runCodexOAuthLogin(deps, opts = {}) {
+  const providerId = opts.providerId ?? CODEX_PROVIDER_ID;
+  const pkce = generatePkce();
+  const state = createState();
+  const ac = new AbortController();
+  let sigintCount = 0;
+  const onSig = () => {
+    sigintCount += 1;
+    if (sigintCount === 1) {
+      deps.renderer.write(color.dim("\n  Cancelling sign-in\u2026 (press Ctrl+C again to force-quit)\n"));
+      ac.abort();
+    } else {
+      process.exit(130);
+    }
+  };
+  const external = opts.signal;
+  const onExternalAbort = () => ac.abort();
+  if (external) {
+    if (external.aborted) ac.abort();
+    else external.addEventListener("abort", onExternalAbort, { once: true });
+  } else {
+    process.on("SIGINT", onSig);
+  }
+  const server = await startLoopbackServer2(state, ac.signal);
+  const authorizeUrl = buildAuthorizeUrl(pkce.challenge, state, server.port);
+  const osc8 = (url) => `\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\`;
+  deps.renderer.write(
+    color.bold(`
+  Sign in with ChatGPT \u2014 ${color.cyan(providerId)}
+`) + color.dim("  Uses your ChatGPT Plus/Pro/Team subscription (not an API key).\n") + color.amber("  \u26A0 Using a subscription outside the official Codex client may violate\n") + color.amber("    OpenAI\u2019s Terms \u2014 your account could be rate-limited or banned.\n") + color.dim("    Sanctioned programmatic use = an API key: ") + color.bold("wstack auth openai") + color.dim("\n\n") + color.bold(`  ${"\u2500".repeat(56)}
+`) + color.bold("  Open this URL in your browser to sign in:\n") + color.cyan(`  ${osc8(authorizeUrl)}
+`) + color.bold(`  ${"\u2500".repeat(56)}
+
+`)
+  );
+  if (server.bound) {
+    openBrowser(authorizeUrl);
+    deps.renderer.write(
+      color.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color.dim(`  (Listening on ${redirectUri(server.port)} \u2014 press Ctrl+C to cancel.)
+`)
+    );
+  } else {
+    deps.renderer.write(
+      color.amber("  \u26A0 Could not start the local callback listener (ports 1455 and 1457 in use).\n") + color.dim("  After signing in, copy the full redirect URL from your browser\n") + color.dim("  (it starts with http://localhost:1455/auth/callback or :1457) and paste it below.\n")
+    );
+  }
+  let code;
+  try {
+    if (server.bound) {
+      const callback = await server.waitForCode();
+      if (ac.signal.aborted) {
+        deps.renderer.write(color.dim("  Cancelled.\n"));
+        return 1;
+      }
+      if (callback) code = callback.code;
+    }
+    if (!code) {
+      const input = (await deps.reader.readLine(
+        `
+  ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
+      )).trim();
+      if (input.toLowerCase() === "q" || input === "") {
+        deps.renderer.write(color.dim("  Cancelled.\n"));
+        return 1;
+      }
+      const parsed = parseAuthorizationInput(input);
+      if (parsed.state && parsed.state !== state) {
+        deps.renderer.writeError("  State mismatch \u2014 please restart the login flow.");
+        return 1;
+      }
+      code = parsed.code;
+    }
+    if (!code) {
+      deps.renderer.writeError("  No authorization code received.");
+      return 1;
+    }
+    deps.renderer.write(color.dim("\n  Exchanging authorization code for tokens...\n"));
+    const tokens = await exchangeAuthorizationCode(code, pkce.verifier, ac.signal, server.port);
+    const accountId = extractAccountId(tokens.access) ?? (tokens.idToken ? extractAccountId(tokens.idToken) : null);
+    if (!accountId) {
+      deps.renderer.writeError(
+        "  Signed in, but the token has no ChatGPT account id.\n  This account may not have Codex/ChatGPT subscription access."
+      );
+      return 1;
+    }
+    deps.renderer.write(color.dim("  Fetching available models...\n"));
+    const models = await resolveCodexModels(
+      deps.modelsRegistry,
+      tokens.access,
+      CODEX_BASE_URL,
+      ac.signal
+    );
+    const saved = await saveCodexTokens(deps, providerId, tokens, accountId, models);
+    if (!saved) return 1;
+    const modelHint = models[0] ?? "gpt-5.5";
+    deps.renderer.write(color.green("\n  \u2713 Signed in with ChatGPT!\n"));
+    deps.renderer.writeInfo(
+      `  Saved as provider ${color.bold(providerId)}${models.length > 0 ? ` (${models.length} models)` : ""}.
+  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` + color.dim("  Tokens refresh automatically before they expire.\n")
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
+    deps.renderer.writeError(`  Login failed: ${msg}`);
+    return 1;
+  } finally {
+    server.close();
+    if (external) external.removeEventListener("abort", onExternalAbort);
+    else process.off("SIGINT", onSig);
+  }
+}
+async function saveCodexTokens(deps, providerId, tokens, accountId, models) {
+  const entry = {
+    label: "oauth-default",
+    apiKey: tokens.access,
+    createdAt: nowIso(),
+    authMethod: "oauth",
+    expiresAt: new Date(tokens.expires).toISOString(),
+    refreshToken: tokens.refresh,
+    tokenType: "bearer",
+    scope: CODEX_SCOPE,
+    accountId
+  };
+  try {
+    await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
+      const existing = all[providerId];
+      const p = existing ? { ...existing } : { type: providerId };
+      p.family = "openai-codex";
+      if (!p.baseUrl) p.baseUrl = CODEX_BASE_URL;
+      p.models = [...models];
+      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
+      keys.push(entry);
+      writeKeysBack(p, keys);
+      p.activeKey = entry.label;
+      all[providerId] = p;
+    }, deps.profileConfigPath);
+    return true;
+  } catch (err) {
+    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
+    return false;
+  }
+}
+
+export {
+  openBrowser,
+  startLoopbackServer,
+  runCodexOAuthLogin,
+  fallbackCodexProviderModels,
+  filterCurrentCodexModelIds,
+  isCodexCatalogModel
+};
+//# sourceMappingURL=chunk-PYTFS4MC.js.map

package/dist/{chunk-L5CE52XW.js → chunk-V76R7DC5.js}

@@ -1,12 +1,12 @@
 import {
   LOCAL_LLM_PRESETS,
   runLiveProviderPicker
-} from "./chunk-ZNZJ34RF.js";
+} from "./chunk-PEMN4T5O.js";
 import {
   openBrowser,
   runCodexOAuthLogin,
   startLoopbackServer
-} from "./chunk-GO3TJICK.js";
+} from "./chunk-PYTFS4MC.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -146,9 +146,10 @@ async function runClaudeOAuthLogin(deps, opts = {}) {
   const ac = new AbortController();
   const onSig = () => ac.abort();
   const external = opts.signal;
+  const onExternalAbort = () => ac.abort();
   if (external) {
     if (external.aborted) ac.abort();
-    else external.addEventListener("abort", () => ac.abort(), { once: true });
+    else external.addEventListener("abort", onExternalAbort, { once: true });
   } else {
     process.on("SIGINT", onSig);
   }
@@ -222,7 +223,8 @@ async function runClaudeOAuthLogin(deps, opts = {}) {
     return 1;
   } finally {
     server.close();
-    if (!external) process.off("SIGINT", onSig);
+    if (external) external.removeEventListener("abort", onExternalAbort);
+    else process.off("SIGINT", onSig);
   }
 }
 async function saveClaudeTokens(deps, providerId, tokens, models) {
@@ -257,7 +259,6 @@ async function saveClaudeTokens(deps, providerId, tokens, models) {
 }
 
 // src/auth-menu/github-copilot-oauth.ts
-import { spawn } from "node:child_process";
 import { color as color2 } from "@wrongstack/core/utils";
 import { FetchError as FetchError2, ParseError as ParseError2 } from "@wrongstack/core/types";
 import { copilotBaseUrlFromToken, refreshCopilotToken } from "@wrongstack/providers";
@@ -272,17 +273,6 @@ var COPILOT_HEADERS = {
 };
 var COPILOT_API_VERSION = "2026-06-01";
 var COPILOT_PROVIDER_ID = "github-copilot";
-function openBrowser2(url) {
-  try {
-    const platform = process.platform;
-    const { command, args } = platform === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
-    const child = spawn(command, args, { stdio: "ignore", windowsHide: true });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
 function sleep(ms, signal) {
   return new Promise((resolve, reject) => {
     if (signal.aborted) return reject(new DOMException("Aborted", "AbortError"));
@@ -430,7 +420,7 @@ async function runCopilotOAuthLogin(deps, opts = {}) {
 
 `)
     );
-    openBrowser2(device.verification_uri);
+    openBrowser(device.verification_uri);
     deps.renderer.write(color2.dim("  Waiting for you to authorize in the browser...\n"));
     const githubToken = await pollForGitHubToken(device, ac.signal);
     deps.renderer.write(color2.dim("  Authorized. Fetching your Copilot token...\n"));
@@ -715,6 +705,7 @@ function validateFamily(raw) {
 
 // src/auth-menu/add-provider.ts
 import { atomicWrite, color as color5 } from "@wrongstack/core/utils";
+import { catalogProviderIdFor, PROVIDER_DEFINITIONS } from "@wrongstack/providers";
 import * as fs from "node:fs/promises";
 
 // src/provider-id.ts
@@ -726,6 +717,20 @@ function nextCustomProviderId(existing) {
 }
 
 // src/auth-menu/add-provider.ts
+function ownDefinitionsAsCatalog(known) {
+  return Object.values(PROVIDER_DEFINITIONS).filter((d) => !known.has(d.id) && d.family !== "unsupported" && d.usage !== "local").map((d) => ({
+    id: d.id,
+    name: d.name,
+    family: d.family,
+    envVars: [...d.envVars],
+    models: [],
+    // `discoveryOnlyBaseUrl` definitions keep their model-list URL out of the
+    // Base URL prompt: offering it as a default persists it as the provider's
+    // wire base, which is a different endpoint (see the AI Gateway entry).
+    ...d.baseUrl && !d.discoveryOnlyBaseUrl ? { apiBase: d.baseUrl } : {},
+    ...d.docsUrl ? { doc: d.docsUrl } : {}
+  }));
+}
 async function addFromCatalog(deps) {
   let catalog = [];
   try {
@@ -736,6 +741,7 @@ async function addFromCatalog(deps) {
   if (catalog.length === 0) {
     return addManualEntry(deps);
   }
+  catalog = [...catalog, ...ownDefinitionsAsCatalog(new Set(catalog.map((p) => p.id)))];
   const saved = new Set(Object.keys(await loadProviders(deps)));
   deps.renderer.write(
     color5.dim(
@@ -937,7 +943,7 @@ async function addKeyForProvider(providerId, deps, template) {
 }
 async function resolveDefaultModelId(deps, providerId, template) {
   if (template.models && template.models.length > 0) return template.models[0];
-  const catalogId = template.type && template.type !== providerId ? template.type : providerId;
+  const catalogId = catalogProviderIdFor(providerId, template.type);
   const provider = await deps.modelsRegistry.getProvider(catalogId).catch(() => void 0);
   return provider?.models?.[0]?.id;
 }
@@ -1327,4 +1333,4 @@ export {
   addKeyForProvider,
   runAuthLocal
 };
-//# sourceMappingURL=chunk-L5CE52XW.js.map
+//# sourceMappingURL=chunk-V76R7DC5.js.map